Analysis
- max time kernel
102s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 03:31
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 939KB
- Sample260705-d3g3dag13x
- SHA256 4e1f1bbe63b6ed0257f8bd8dc651a9233aa71f3b7f839b0150d283ccefea7030
- MD5 bd96fd3ad26e61bf2ee571f483ad0e3d
- SHA1 78f0b14b0038cf140a32668ea576400bcd1f7be7
- SHA512 e47c4f833f61c2143276440abb3e3794b7c5c972790b0fc1722f3d1394df71a79baef13c685cee1b8b9a551ab691ebe7feff9141cc7f32cfa19c25577dddbf30
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiN:cuytJJ8y5iTve
- TLSH T181259E1277E444B6E162823489E19756EB76FC620F20C7CF6394971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/3704-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c672-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b7-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2e4-33.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-268.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198cc-437.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-486.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-505.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-590.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-615.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-670.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-725.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-738.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-781.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-794.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-843.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-862.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-881.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-888.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-901.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-920.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-945.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-976.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-1013.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-1044.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1081.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1094.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1131.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1144.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1169.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1176.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1213.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1316.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1329.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1354.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1367.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018903-1470.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3704-1981-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/256-1994-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 256 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe - Drops file in Windows directory 61 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3704 2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe 256 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_bd96fd3ad26e61bf2ee571f483ad0e3d_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3704
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:256
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 939KB
- SHA256 4e1f1bbe63b6ed0257f8bd8dc651a9233aa71f3b7f839b0150d283ccefea7030
- MD5 bd96fd3ad26e61bf2ee571f483ad0e3d
- SHA1 78f0b14b0038cf140a32668ea576400bcd1f7be7
- SHA512 e47c4f833f61c2143276440abb3e3794b7c5c972790b0fc1722f3d1394df71a79baef13c685cee1b8b9a551ab691ebe7feff9141cc7f32cfa19c25577dddbf30
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiN:cuytJJ8y5iTve
- TLSH T181259E1277E444B6E162823489E19756EB76FC620F20C7CF6394971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 968KB
- SHA256 913d48375f281fe5e33274c7e35d46f61d58c4dba106917d851bb8af304251ff
- MD5 8356bc136bed44d4f484078be11d34b4
- SHA1 6b627cd981585d2a3214d5895555283d99e91511
- SHA512 66cfc5eef49edf4a09fa8a97bdf16946a6bd0f3286f310cbbd0f82f1f3dcedf0e2a5da1d0863fc3624666eb96b828e69b989404bf270b5f780c3cf2c7aca6810
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEibP:cuytJJ8y5iTvu
- TLSH T12A259D1277E444B2E162823489E19756EB76FC620F20C7CF6394971E1F72BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 f67d6005bc04ea8e3beadf08e30e22922a910a7719d77defbda254ca41e9d759
- MD5 503f81efdcae4059721c6fbdc961c7d3
- SHA1 97e7662ff6eaa289d3f3ecc9fa7260913c5901b7
- SHA512 062802282b0646a33cf6decc9599e0e211538b611fa362587d1e93654fafbf4570bb72bf6688d9cb079a47296a7ed5001526679df52fc1b405c3618445b7b063
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiZ0Le5ji0hmxNrM:cuytJJ8y5iTvOPji0Aj
- TLSH T135656C16F6A44671E073C175C5D2975AEA7278520B308BCB5384876D2F33BE29E3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 954KB
- SHA256 f0f1e921120ea4a35be3a50fff4053e9055498b518ddfbac70c643a954b40992
- MD5 678fdbb024f815576698790824102f30
- SHA1 808678b48422f47fcd28ef6f7aee9c2f5bf2e647
- SHA512 8f8ead05fdc3480610ca5713927f539a04c1685c388fbda2fa45d862dcee825b369b81140e9da42d8a31193c404dedd61790ba912ca252a3c43746c12b938e66
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiLa:cuytJJ8y5iTv
- TLSH T128259E1277E444B2E162823489E19756EB76FC620F20C7CF6394975E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 963KB
- SHA256 7f071511bb5261cdf55ec51d49bc485f7285083c637ab668c7b7f2d09083b749
- MD5 64445e9cfbe54609b51c0f6812bd1cf6
- SHA1 73906b4285899b03dfae97cd2911189887343a9e
- SHA512 94247df39ccd29735ac25bbfc8dfbabd0de945cde83f825d78620b052519e9847db737b8af949b6448f9f120903fdafd90ce70580915d2a95eac0d10616f1992
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEia9:cuytJJ8y5iTvb
- TLSH T184259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 963KB
- SHA256 18b579a72848e74d47f25f50067c30243ca195a5f3a45f8c5427501cc5df14f6
- MD5 06aa2670df7ffd0fee4c12e743da6407
- SHA1 efad35dddad8fa754e0aff16c78ad3367135e794
- SHA512 a613bff8af74078c813c50041ddadaf3e18e08be9b101c811e8b41b7869f7d047dc9420134f5789eeed77be63b6322db8595090ce80a10b1c8efc472a36a218a
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiac:cuytJJ8y5iTvS
- TLSH T122259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 963KB
- SHA256 e70549ba57ebb5ab8df7b673d2014c7fe13a2ac26fa8684dc0fb991a31ee80f3
- MD5 3585b52d0d05436fc82efd8f574bb643
- SHA1 47b4bd2c70d8c54aeade2c67afeaae825155ada8
- SHA512 c8ecb3925153c4c5f898c2af583cbe2cdb759d3f583c5acac3f9fbb236140889676445041708b35e2789696337d12eec48c51cb7e3d771340678ff1dc722ca05
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiTp:cuytJJ8y5iTvY
- TLSH T1B025AE1277E444B2E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 963KB
- SHA256 3606a5e20bdeb56a7f3944982158eeee1fb33e44d375e89073ac220a5beb9234
- MD5 05066d556d97b211fc2334677b32bb58
- SHA1 71715a14ee71a04e9f9de67048eb8da373c27276
- SHA512 a9b3bcd66876833f03daadbfb2fbf94269a9e6bd0fc8e8d6cac49c35bd2527b8d7e60636794f530b231b29e208248b424284997c7a0716ab16ddab0b38990df3
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEi0N:cuytJJ8y5iTvH
- TLSH T1E2259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 963KB
- SHA256 47108af2463b376ebc962369c087b8dc94bb43e8dec8d836d6e3b82b8341ad17
- MD5 aae9ef0f55d04e592b83553c366efa2c
- SHA1 3d2efa8a3a00c6764bc1b208b736eda4207bc613
- SHA512 4747ba069e2de152790ccf81e3fcb6ab78aaa238178a0bf0b8ab0482bc64a1035de7663644a9d241656e66f0530ac8985aa8361b62801a290bf28ecfcd7231e8
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEicF:cuytJJ8y5iTvB
- TLSH T19A259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 963KB
- SHA256 82d4da02fb95af9dd320f3c668dd5251296630d9348d714676074769f8f8d076
- MD5 0c6fe7b53e04438d039b41c121b595ad
- SHA1 8047125e3abfede245f0683c97f07168f69ae2e6
- SHA512 1684c378d3a4c22cee6c0dc58a5f86e7fca117b08492a5b09e9547d7519eb4c2b83b2d06b18f3e5db539bf544755ada3801ef8902e48b4fa34e0a0ab91b4cc6a
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiJC:cuytJJ8y5iTvt
- TLSH T1DE25AE1277E444B2E162823489E19756EBB6FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 963KB
- SHA256 0e7d5348b3f675cf554323903dabaf69eae76e8b9ecfa0f0c4518d7d709a445b
- MD5 09fe6e68434572715a8e317e46429338
- SHA1 8c774de4c744b2daa55f6ef99e99ad326f1d31e1
- SHA512 114178df78672937acd0c0c6ce5eaf7f9826786cae861919a2d93cb376771c35f458466da2c06519dfbd31dda39cc11d0e64a98992c510e3cca57eef36260e68
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiqw:cuytJJ8y5iTvw
- TLSH T19E259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 963KB
- SHA256 760e6042d505f68014db7aa854fd0e109ff7ba1cf6f3ca629d8f587b53936060
- MD5 aed43a5f6bed4ca1b19805f4fac639b1
- SHA1 8fd63be978f0ce5857257e231048247c3a4b622e
- SHA512 6b8bc0c6b6a3ae23dfdb1ab8d3e48415af282a1e9bc6f24cbf2fee81cb6c4ca98c2035d2fc21bbe74f5a482086bde7647c722baa5e1364acc994e5095f400ed2
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEixT:cuytJJ8y5iTvI
- TLSH T15D259E1277E444B2E162823489E19756EBB6FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 963KB
- SHA256 8b6e884ce8e32185f191e8cfad92b6fcfbdd98e79c773006067a85aa41bcad78
- MD5 07934aa62ee3fd92fed34b110095676f
- SHA1 b6bb737969e64bc85f080a10cd1c0d020f433269
- SHA512 3cf7b0ec5a120227acdea7ce08be475cae5c2320459e9f2ed807486bf9e0e9b907ef4d153b0593e8a3ef4e278b0f3decf9495aacd2f51af7e18cb2af15325e9a
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEifu:cuytJJ8y5iTvX
- TLSH T195259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 963KB
- SHA256 4288b95cd2cdfaae0da69c64c54d9fcecf8ce416c6d858fec217f68c3e417d61
- MD5 c4a8415e1d72c88b5cbe18059a41fe14
- SHA1 d4e9628f19a388007efc31faa1739d5708073c48
- SHA512 3f0c3dc7a074f2fc443cb4f15bc45e74bd17d487584b81cd84f51a336e80b69b88b6079af867e85aeb0c2bbbbc5f3d0500afedffacc55d7dae98b4af7b411388
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiDb:cuytJJ8y5iTvO
- TLSH T11A259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 963KB
- SHA256 617b5b5f494d38aa6c050841f9664db9dcbce0bb4f50c5a49ad2ff883acae56c
- MD5 befb3a7a4e4cb5982d16718f4da3c970
- SHA1 2083f1ecfc59b0362cacb13550965b5075b298fd
- SHA512 f58d9a2465a458d32dbc5e1ee98de4445fa8267ba331deec5a03a27b247b22faa2f473929b290e2fd75a04b2d06df2bd2f96c871f1d213db9a28675aee2b5bcf
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiXf:cuytJJ8y5iTvu
- TLSH T19E259E1277E444B2E162823489E19756EBB6FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 963KB
- SHA256 024f3d328645340e3335c285bff64f78f4c1d932154e585b86c27c3ac0064db8
- MD5 972d97e093847d73e6afd1a64b82bdf3
- SHA1 d6da9a2d737560529015b11777a9b0dc5e54b071
- SHA512 4a7a36060402080a43315415392fcfa6129a8f1a202f54bc1b4ecd857aec96d3a3e6f4cc7c58da07ae67e941ee4188ebf85520464bb68fa8acad816bede52bf9
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEigK:cuytJJ8y5iTvO
- TLSH T18A259E1277E444B2E162823489E19756EBB6FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 963KB
- SHA256 353de0056a3cc1ec8ef361b0b262f7b376c5f3156807211968fd64ad96f025e0
- MD5 b1e3fddbf8b90809cd1f3d4861ecb453
- SHA1 27def14a3e325e5922fd30993e717f907375533a
- SHA512 9503b0bdb5055d0fc4aa2554c9b3dacc9ccb0e03980cd2831a05403a7440e1404dbccfd368833969dd46504d708c4a1923a5dd502ff60ac1b02759fe46196311
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEidk:cuytJJ8y5iTvz
- TLSH T160259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 963KB
- SHA256 c4d783047d8239a846717d7681cf98628726d7b9d2f253b1c277d2ed97e4c71f
- MD5 a3726e4599ab55edaf5aedabbe900778
- SHA1 5ac4421c9dc025b3b5e621fad77e960d5d8f3489
- SHA512 87a05959e28f6b258181116dcf966c79ddd1e3efcf1d283b1c25c7ad19580031f49eee50a6b5218649383fd45088e0a3a90c6e058e25ad7155a38116346aa103
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiC0:cuytJJ8y5iTvS
- TLSH T1E0259E1277E444B2E162823489E19756EBB6FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 963KB
- SHA256 49f2bc8f6b640ca02fb904e9d45f94b2b9728609d50a2d363bd8e84a09513b0a
- MD5 801aa97f5c110dc22fafba50090e01db
- SHA1 e096d11b2034ed3593ef27f109363971af1da4b4
- SHA512 d8e8eeed8809b2a6f17a8588565bd878fb043a63672d98d3123b0dc2d228b11f165a96e826da6f847656646d3631eeb2f25bfd292a5f7252e87ff21ce7752e07
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiRg:cuytJJ8y5iTvr
- TLSH T142259E1277E444B2E162823489E19756EBB6FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 963KB
- SHA256 fafa0e0927f27b4e2a9c4ebe4a9b8f4b6e275b6b45f768741605219f7c2086e2
- MD5 359f1ba10d4e7b2cbaa9eab2b24a07a5
- SHA1 1c2c62ec42d79c4a45f4bf7f384a3c899de76bed
- SHA512 573b35e030cc197a6968d1b27d95cf82b8b9f9e66bb8daf33c27fd482f0abf16170fab31415fe50eb09b613c8e68092cfe00bda4e76d9bcdffe843c9b7fe01c0
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEi4r:cuytJJ8y5iTvd
- TLSH T17C259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 963KB
- SHA256 49c84e091a05ec972696c1fef40f1eb06fe8fbfc02d918e55638cdb16256eed2
- MD5 ecb7dfc8b578e883a97a52216c708aa6
- SHA1 351ce2f8e11a73906a9f0c85630a7e6c44b91c71
- SHA512 55e5889bee4fa390f23db1bfd7f5540371af6d11475793832e3b6a6eb379bc0eff1cecefd90a9cabb0fce662d6ad3df20b027c3d50b6137106d98a7eb3da28d3
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiWn:cuytJJ8y5iTv/
- TLSH T1C4259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 963KB
- SHA256 2f38f69dcf8383d7bd73a4d30990bc11e2edbcdb691ec4595116ed5a3c1bf233
- MD5 cb9b13b3b03c22a6bdd91da90bddd6b8
- SHA1 66fe9d001830be59db48ab715bff482a358a1830
- SHA512 c6e631337e8de3a530d9c776ce8d1cc919f4b15a6db72f219bc3afca9b6f42963993a42ed2fc6a4a4a7769e6812b55207342d2fdd1d0c8c669206d5d376b5582
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEi8x:cuytJJ8y5iTvF
- TLSH T14A259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 963KB
- SHA256 f4aabbef626e40d6cf267e29a4db201e312ad90370ffbbd6efa4ff5d8f7953d3
- MD5 c0a8245031384103caf5341c07745e71
- SHA1 d52e648b31b5eec1286d6857292c3de318acc72b
- SHA512 b8b1e57ccdfd6a7e2489eb6dd037c4cbd8d42019fbb0a8739c74539f59e00a3817142e7c3c4b99b45fe41f062552b50d564dfd15e56a7086ef047ccfc4cb761b
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEi2A:cuytJJ8y5iTvK
- TLSH T1A5259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 963KB
- SHA256 6358ffd96c7c2b51d86f206c18b8091cdf0b34b8a4a3fe7d0abcc6fb35d7ae96
- MD5 aa720f00f6d5c52ea98d4c1091baed7d
- SHA1 bdd7e36432842b51b55409243f89d14d4690bee6
- SHA512 61e3e2eee6c0b0f52e0037d4b876b8228494d17dfb03e536e7726be20406a027b58d3668b44b77119a74b40adb837306de5a8cc7faa1e47c443fd0ac012c8129
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiv9Q:cuytJJ8y5iTv3
- TLSH T13D25AE1277E444B2E162823489E19756EBB6FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 963KB
- SHA256 40afabb0daa6ba1c9bc51a0c1c5b58269486e3a075cf32bf4c5aa7efe06c98da
- MD5 97406d5283d3f7f40e4a5b2bb8bdd082
- SHA1 5da0b56a2bb1a2acb5cc02476df8aa4a9af1a063
- SHA512 901324a958efc033554b0b5095d8035671b2aec1249515e2c0e43bc66264b532e85478d494915ee9d2b8dfe49f4de2e44f3a3eb204c549bde5cf070a9c97eea6
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiG4:cuytJJ8y5iTvo
- TLSH T19E259E1277E444B2E162823489E19756EB76FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 963KB
- SHA256 5da0d4ffdcd744db11108923b6e04b667718fa728f2c9f48921c41db22795189
- MD5 61c99677b310cb1e89c4c678959c63ab
- SHA1 34314fc063a6bbdfd42550fc7a518029fed2128b
- SHA512 cb607d53bb4be366ea7c6dd8372a00bef7aa53533f3fc283804c78d46808074dc1c54bb69e98e37b8c1f4d48e45e57d1accd527a5c39135f21867ca5eea840aa
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiVu:cuytJJ8y5iTv5
- TLSH T1CD259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 963KB
- SHA256 33e07ff302c76838e171df032ce7423fdf82bca84d1ebfa0d7cdc2fd20aeb8ba
- MD5 373b733c0bb771c02f834a7e34418247
- SHA1 16b0af03f92f4f9755c65ead0547ea0d8ffacdbf
- SHA512 7cad5d42926ccb3f543c5ce4fcb6a4726b0fe3f4890377daa3b1743d58b026c25cbdfec7228a65273a888160e96ad9dc693eba350d0e6fc9aecae442c8a81ffd
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiIj:cuytJJ8y5iTvj
- TLSH T12225AE1277E444B2E162823489E19756EBB6FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 963KB
- SHA256 cb6779a6e3cf90f11f500d72d330de79e6fc806bc04a899499c0dee3c77a307c
- MD5 98477fe094d752d032dd8bf355b63ae9
- SHA1 0ed5f222ab1b1df9847c03f7c340529c15b39c0b
- SHA512 6d873c6d9749e34d6a11968af4a4c56a847483a44d89d9d8969e48bf0e9c3924871d614e21e7a847918f8ab86da2fe4e3387e249f46293f1fde37753f35c8b81
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEi5g:cuytJJ8y5iTvL
- TLSH T11B259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 963KB
- SHA256 b25b209f15d4895a0242fb2d780422bb1fb2254095e3245e4ef06d8faa1da1b7
- MD5 f20df34fe77d9475df8090d6921e69fe
- SHA1 804bd8b27581101359abd690e404a65b5e2efc7e
- SHA512 b7be9eeb727501f36842a59568069140587e8f70213643d38b5b4b9c9b5291bd131e440db95a50996bcf6fe6cbeb36922aba22367daaac91592a67287a74b57e
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEigI:cuytJJ8y5iTvi
- TLSH T1F1259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 963KB
- SHA256 077a5c11011d62c74709f6a2c6dfbfe7e91975b213660b6140acdf1df9fa007d
- MD5 1237ca04ff262f54f728059cbb7e3938
- SHA1 befa901a4fd9c72ac419ebdbf50bfe6923e40388
- SHA512 47b476a925c477158422b28341f3eb4db6812a36bada59976e67670b4bdf962752c074c10171f1ff7d6a2df0f7e2e69622b6c63872bac57198db937ffd5618fe
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiio:cuytJJ8y5iTvA
- TLSH T1D2259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 963KB
- SHA256 5d911b90a23d7e1911a6ab5ab99a8a60072c532e2dd42ebe5837baafa7c6e158
- MD5 cbb924afc6b913e06e4de969038486c1
- SHA1 c96404d284371c2ff5a0cf7a32b2bc650f748d8e
- SHA512 01a0050b891b2a1f530952402043cb58e02eaaae783c0e47019d67c80e2714c452583f6124ea8225fe76d1149b851a2f7ca3b0378a7eb980b970697a0d5657c2
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiZ+:cuytJJ8y5iTvt
- TLSH T11A259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 963KB
- SHA256 edad03fd795b21c6f9e17a34b2731e8719f85a623dbe7f6bfbeb5f6bcc64933c
- MD5 c204cbfc2a00b4363ada81d4f1a7b150
- SHA1 23903bc52146a7aef44f0f750de5e86f92f957cc
- SHA512 ed3bf173ae9730138a3fc05c37f09df9546aad3419fdbaf894c8f42f28cec5533532b3c04b703beeee147a00bb0ddd366972ebddaad4edd258292e1700fbac28
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiHQ:cuytJJ8y5iTvl
- TLSH T148259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 963KB
- SHA256 01366918d8f4cea9cf486cb58b2b983ef90b5bb9e6ad4148e11744432b46fdbd
- MD5 fabf40819b8a06400dae7ab375a1b00b
- SHA1 6c4ad58c55a6338c7d640c6a3553ad5c652238a5
- SHA512 691139eedb1ed426ef39f48cdabd7a0f77033e70d90ca49452e660489b573e0bdc33ad61e62f7212673d4a6ccde2352f3a6a62ecc2bb7366f216629a591214ce
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEicX:cuytJJ8y5iTvx
- TLSH T12D259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 963KB
- SHA256 21ac480007e977fbde270683ae415e9fa32191a9df74876a602c821bef50bac7
- MD5 0c55edc58c4f726a01e430b323414428
- SHA1 a04b53de0850d03cbd6c3596e0e71352b7830036
- SHA512 1417f00547067cb7d2e5886762b70dd217ec4e6b1876208f450c5706df62131884e211d8a5671aa5f115c078b3d6981083ab3cb622631cbf8cad4472c2eb0b8d
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEiaL:cuytJJ8y5iTv7
- TLSH T167259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 963KB
- SHA256 ff2c00a8e4108cd034533efc21c794b8d48957e18ba1492837541603fcc87f0f
- MD5 e7e8edfc339b4f2e5b30c6d0ca159d55
- SHA1 5c1b0d8941a3105e9a29ac42008f9d1116c4a686
- SHA512 33629c0c5fc9a1949c37ad79de41c749717eb0f4d3a0a13d0a1fd750e44c9c6c90f7b59e3b512efae335974e9a701535c5ec14c9184c9d6de77de2be3298e649
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEi+M:cuytJJ8y5iTvW
- TLSH T15A259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 963KB
- SHA256 be76867eca550e0bb44cd33dae26842a07333e9e0969da8aa4303562814eed82
- MD5 f767629945d6ff1beb08362c3892c797
- SHA1 c3c3f405d13f8f29f2f73e5b21aa41e6b9ec876e
- SHA512 c721a0bbb62c9c0e2ec63a54f237043edf1987bb346deae4d696d325fadab3fc44ae1aa0b964b608604be040f9db06387e4845c250d5dd7201b5bf3d873ee839
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEinh:cuytJJ8y5iTvo
- TLSH T1F1259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH